chore(deps)(deps): bump the dev-tools group with 2 updates #786
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # --- L9_META --- | |
| # l9_schema: 1 | |
| # origin: l9-template | |
| # engine: graph | |
| # layer: [ci] | |
| # tags: [L9_TEMPLATE, ci, compliance] | |
| # owner: platform | |
| # status: active | |
| # --- /L9_META --- | |
| # | |
| name: Architecture Compliance Check | |
| on: | |
| pull_request: | |
| branches: [main, develop] | |
| push: | |
| branches: [main, develop] | |
| jobs: | |
| compliance: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Set up Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: '3.12' | |
| - name: Install dependencies | |
| run: | | |
| pip install -r requirements-ci.txt | |
| pip install -r requirements.txt | |
| - name: Check for banned files | |
| run: | | |
| # Fail if engine/middleware.py exists (tenant resolution is chassis-only) | |
| if [ -f "engine/middleware.py" ]; then | |
| echo "ERROR: engine/middleware.py exists (tenant resolution is chassis-only)" | |
| exit 1 | |
| fi | |
| # Fail if engine/api/ directory exists (app factory is in chassis/chassis_app.py) | |
| if [ -d "engine/api" ]; then | |
| echo "ERROR: engine/api/ directory exists (app factory belongs in chassis/)" | |
| exit 1 | |
| fi | |
| - name: Check for FastAPI imports in engine/ | |
| run: | | |
| # Allow chassis imports ONLY in engine/handlers.py | |
| violations=$(grep -rl "from fastapi import\|import fastapi" engine/ --include="*.py" | grep -v "engine/handlers.py" || true) | |
| if [ -n "$violations" ]; then | |
| echo "ERROR: FastAPI imports found in engine/ (only handlers.py allowed):" | |
| echo "$violations" | |
| exit 1 | |
| fi | |
| - name: Check for Cypher injection patterns | |
| run: | | |
| # Delegate to the repository's canonical scanner; do not maintain a second regex. | |
| python tools/contract_scanner.py | |
| - name: Run ruff linter | |
| run: ruff check . | |
| - name: Run mypy type checker | |
| run: mypy engine/ --config-file=pyproject.toml --ignore-missing-imports --exclude chassis | |
| - name: Validate domain specs | |
| run: | | |
| # Ensure all YAML specs can be loaded by Pydantic | |
| # Schema drift (snake_case YAML vs camelCase Pydantic) tracked in issue #XXX | |
| python -c " | |
| from pathlib import Path | |
| import yaml | |
| from engine.config.schema import DomainSpec | |
| warnings = [] | |
| for path in Path('domains/').glob('*_domain_spec.yaml'): | |
| with open(path) as f: | |
| try: | |
| DomainSpec.model_validate(yaml.safe_load(f)) | |
| print(f' {path}: OK') | |
| except Exception as e: | |
| warnings.append(str(path)) | |
| print(f' WARNING {path}: schema drift (non-blocking)') | |
| if warnings: | |
| print(f'Note: {len(warnings)} domain spec(s) need schema alignment (tracked separately)') | |
| print('Domain spec validation complete') | |
| " |